The vulnerability resides in V2Board 1.7.4, where the custom_html field in theme configuration is rendered through Blade without escaping. An administrator can inject arbitrary JavaScript via the saveThemeConfig API, and because the payload is rendered unescaped on the public dashboard page, every site visitor who loads the dashboard will execute the malicious code. This allows the attacker to exfiltrate session cookies, hijack user sessions, or perform phishing attacks from the compromised site. The weakness is a classic Cross‑Site Scripting flaw, originating from improper output neutralisation.

V2Board 1.7.4 and earlier versions are affected. The flaw lives in all installations that use the dashboard theme configuration API to store arbitrary HTML content.

The CVSS score of 6.9 classifies the issue as high severity. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated administrator to inject the payload; however, once injected, every visitor to the dashboard page is impacted. This makes the vulnerability a moderate to high risk for sites with active administrative access, as attackers could compromise all users by first compromising or gaining access to an administrator account.